Controllo virus

[zena]

Ciao a tutti, scrivo perchè è un periodo che mi si aprono delle finestre di sicurezza di windows con richieste di bloccare dei programmi .exe e cmq il pc mi va piu lento del solito.
Di seguito allego il report che ho fatto con Hijack, con la speranza che possiate darci un occhiata e dirmi se c'è qualcosa che non va o cma qualcosa da eliminare:

Logfile of HijackThis v1.99.1
Scan saved at 20.18.38, on 21/03/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5700.0006)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\clipsrv.exe
C:\WINDOWS\sm56hlpr.exe
C:\Programmi\D-Tools\daemon.exe
C:\Programmi\iTunes\iTunesHelper.exe
C:\Programmi\Java\jre6\bin\jusched.exe
C:\WINDOWS\vVX6000.exe
C:\Programmi\File comuni\Ahead\Lib\NMBgMonitor.exe
C:\Programmi\Creative\Shared Files\CamTray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\Nikon\PictureProject\NkbMonitor.exe
C:\Programmi\File comuni\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Programmi\Bonjour\mDNSResponder.exe
C:\Programmi\File comuni\EPSON\EBAPI\SAgent2.exe
C:\Programmi\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmi\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Programmi\MSN Messenger\msnmsgr.exe
C:\DOCUME~1\Fedo\IMPOST~1\Temp\~tmp\hmunmlcn85\svchost.exe
C:\Programmi\Internet Explorer\iexplore.exe
C:\Programmi\Internet Explorer\iexplore.exe
C:\Programmi\WinRAR\WinRAR.exe
C:\DOCUME~1\Fedo\IMPOST~1\Temp\Rar$EX00.297\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/webhp?rls=ig
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=55245&clcid={SUB_CLCID}
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
F3 - REG:win.ini: load=C:\DOCUME~1\Fedo\DATIAP~1\rsvp.exe
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre6\bin\ssv.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programmi\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programmi\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [SMSERIAL] sm56hlpr.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Programmi\File comuni\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Programmi\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Programmi\File comuni\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Programmi\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmi\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmi\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [VX6000] C:\WINDOWS\vVX6000.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Programmi\File comuni\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [Creative WebCam Tray] C:\Programmi\Creative\Shared Files\CamTray.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Programmi\File comuni\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: NkbMonitor.exe.lnk = C:\Programmi\Nikon\PictureProject\NkbMonitor.exe
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Ricerche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\programmi\bonjour\mdnsnsp.dll
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/Fac ... oader5.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://dl8-cdn-01.sun.com/s/ESD5/JSCDL/ ... 586-jc.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{716F82CC-0AC0-42FF-B946-16F4D35AC5F3}: NameServer = 85.37.17.13 85.38.28.81
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Programmi\File comuni\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\SYSTEM32\ati2sgag.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Programmi\Bonjour\mDNSResponder.exe
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Programmi\File comuni\EPSON\EBAPI\SAgent2.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmi\File comuni\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Windows CardSpace (idsvc) - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe (file missing)
O23 - Service: Servizio iPod (iPod Service) - Apple Inc. - C:\Programmi\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Unknown owner - C:\Programmi\Java\jre6\bin\jqs.exe" -service -config "C:\Programmi\Java\jre6\lib\deploy\jqs\jqs.conf (file missing)
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
O23 - Service: ServiceLayer - Nokia. - C:\Programmi\PC Connectivity Solution\ServiceLayer.exe

Sperando in un vostro cortese aiuto
Grazie mille.
ciao

[shel]

ciao

Disattiva l'antivirus e i programmi anti-spyware
Disconnetti il pc da internet
Se hai delle icone di collegamento a programmi sul desktop, crea una cartella apposita e copiale al suo interno

Doppio click su combofix.exe e segui le istruzioni passo a passo, ricordati di dare invio dopo i vari passaggi

Quando avrà finito creerà il log C:\combofix.txt salvalo e postalo come gli altri report.

Nota bene : durante la scansione verranno creati dei file sul desktop e scompariranno le icone, potrebbe succedere che qualche programma ti chiede cosa fare per la rimozione dei drivers, in questo caso accossenti, si tratta probabilmente di drivers infetti.

Il programma creerà la cartella C:\QooBox ed all'interno della stessa verrà posizionato un backup dei files rimossi ed un file di backup del registro di windows chiamato Hiv-backup.

NON TOCCARE MOUSE E TASTIERA durante la scansione.

[shel]

oooopsss...


ecco il link ===> http://download.bleepingcomputer.com/sUBs/ComboFix.exe

[zena]

ciao, intanto grazie per la tua risposta,
di seguito il report di ComboFix:

ComboFix 09-03-19.02 - Fedo 2009-03-22 12.36.29.3 - FAT32x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1040.18.2047.1640 [GMT 1:00]
Eseguito da: c:\documents and settings\Fedo\Desktop\ComboFix.exe
* Creato nuovo punto di ripristino

ATTENZIONE - QUESTO PC NON HA LA CONSOLE DI RIPRISTINO DI EMERGENZA INSTALLATA !!
.

((((((((((((((((((((((((( Files Creati Da 2009-02-22 al 2009-03-22 )))))))))))))))))))))))))))))))))))
.

2009-03-21 19:05 . 2009-03-21 19:05 <DIR> d-------- c:\programmi\TeaTimer (Spybot - Search & Destroy)
2009-03-21 19:05 . 2009-03-21 19:05 <DIR> d-------- c:\programmi\SDHelper (Spybot - Search & Destroy)
2009-03-21 19:05 . 2009-03-21 19:05 <DIR> d-------- c:\programmi\Misc. Support Library (Spybot - Search & Destroy)
2009-03-21 19:05 . 2009-03-21 19:05 <DIR> d-------- c:\programmi\File Scanner Library (Spybot - Search & Destroy)
2009-03-21 18:57 . 2009-01-15 21:15 77,824 --a------ c:\windows\clipsrv.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-11 09:19 38,496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-02-11 09:19 15,504 ----a-w c:\windows\system32\drivers\mbam.sys
2009-01-15 20:15 77,824 ----a-w c:\documents and settings\Fedo\Dati applicazioni\rsvp.exe
2009-01-12 18:45 202,040 ----a-w c:\windows\SYSTEM32\PnkBstrB.exe
2007-07-04 10:28 20 ---h--w c:\documents and settings\All Users\Dati applicazioni\PKP_DLec.DAT
2007-07-04 10:28 20 ---h--w c:\documents and settings\All Users\Dati applicazioni\PKP_DLds.DAT
2007-02-10 03:26 271 --sh--w c:\programmi\desktop.ini
2007-02-10 03:26 23,476 ---h--w c:\programmi\folder.htt
.

((((((((((((((((((((((((((((( snapshot_2008-12-23_19.19.33,18 )))))))))))))))))))))))))))))))))))))))))
.
- 2000-08-31 07:00:00 28,672 ----a-w c:\windows\Nircmd.exe
+ 2000-08-31 07:00:00 29,696 ----a-w c:\windows\Nircmd.exe
- 2008-12-21 13:15:02 137,688 ----a-w c:\windows\SYSTEM32\DRIVERS\PnkBstrK.sys
+ 2009-01-12 18:46:48 137,688 ----a-w c:\windows\SYSTEM32\DRIVERS\PnkBstrK.sys
+ 2009-03-22 11:29:02 16,384 ----a-w c:\windows\temp\Perflib_Perfdata_710.dat
.
((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\programmi\File comuni\Ahead\Lib\NMBgMonitor.exe" [2006-04-21 94208]
"Creative WebCam Tray"="c:\programmi\Creative\Shared Files\CamTray.exe" [2005-10-27 299008]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-19 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroFilterCheck"="c:\programmi\File comuni\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]
"DAEMON Tools-1033"="c:\programmi\D-Tools\daemon.exe" [2004-08-22 81920]
"AppleSyncNotifier"="c:\programmi\File comuni\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-07-22 116040]
"iTunesHelper"="c:\programmi\iTunes\iTunesHelper.exe" [2008-07-30 289064]
"QuickTime Task"="c:\programmi\QuickTime\qttask.exe" [2008-05-27 413696]
"SunJavaUpdateSched"="c:\programmi\Java\jre6\bin\jusched.exe" [2008-12-09 136600]
"VX6000"="c:\windows\vVX6000.exe" [2008-08-04 713744]
"SMSERIAL"="sm56hlpr.exe" [2004-06-29 c:\windows\sm56hlpr.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-19 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\Currentversion\policies\explorer\Run]
"ClipSrv"="c:\windows\clipsrv.exe" [2009-01-15 77824]

[HKEY_CURRENT_USER\software\microsoft\windows\Currentversion\policies\explorer\Run]
"CmSTP"="c:\windows\System\cmstp.exe" [2009-01-15 77824]

[HKEY_USERS\.DEFAULT\software\microsoft\windows\Currentversion\policies\explorer\Run]
"Logman"="c:\docume~1\Fedo\DATIAP~1\MICROS~1\logman.exe" [2009-01-15 77824]

c:\documents and settings\All Users\Menu Avvio\Programmi\Esecuzione automatica\
Adobe Gamma Loader.lnk - c:\programmi\File comuni\Adobe\Calibration\Adobe Gamma Loader.exe [2007-03-02 113664]
NkbMonitor.exe.lnk - c:\programmi\Nikon\PictureProject\NkbMonitor.exe [2007-05-12 118784]

[HKEY_CURRENT_USER\software\microsoft\windows nt\currentversion\windows]
"load"=c:\windows\esentutl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.XFR1"= xfcodec.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Avvio^Programmi^Esecuzione automatica^Alice ti aiuta.lnk]
path=c:\documents and settings\All Users\Menu Avvio\Programmi\Esecuzione automatica\Alice ti aiuta.lnk
backup=c:\windows\pss\Alice ti aiuta.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Avvio^Programmi^Esecuzione automatica^LG SyncManager.lnk]
path=c:\documents and settings\All Users\Menu Avvio\Programmi\Esecuzione automatica\LG SyncManager.lnk
backup=c:\windows\pss\LG SyncManager.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 2008-07-30 10:47 289064 c:\programmi\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NSLauncher]
--a------ 2007-08-02 16:30 3096576 c:\programmi\Nokia\Nokia Software Launcher\NSLauncher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2008-05-27 10:50 413696 c:\programmi\QuickTime\QTTask.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programmi\\Messenger\\msmsgs.exe"=
"c:\\Programmi\\MSN Messenger\\msnmsgr.exe"=
"c:\\Programmi\\MSN Messenger\\livecall.exe"=
"c:\\Programmi\\iDC++\\iDCPlusPlus.exe"=
"c:\\Programmi\\Windows Media Player\\WMPLAYER.EXE"=
"c:\\WINDOWS\\System32\\rtcshare.exe"=
"c:\\Programmi\\NetMeeting\\conf.exe"=
"c:\\Programmi\\eMule\\emule.exe"=
"c:\\Programmi\\EA Sports\\Tiger Woods PGA TOUR 08\\BIN\\TW2008.exe"=
"c:\\WINDOWS\\System32\\dpnsvr.exe"=
"c:\\Programmi\\Atari\\Test Drive Unlimited\\TestDriveUnlimited.exe"=
"c:\\Programmi\\Hamachi\\hamachi.exe"=
"c:\\Programmi\\Bonjour\\mDNSResponder.exe"=
"c:\\Programmi\\iTunes\\iTunes.exe"=
"c:\\Programmi\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
"c:\\Programmi\\Xfire\\xfire.exe"=
"c:\\Programmi\\KONAMI\\Pro Evolution Soccer 2009\\pes2009.exe"=
"c:\\Programmi\\Activision\\Call of Duty - World at War\\CoDWaWmp.exe"=
"c:\\Programmi\\Activision\\Call of Duty - World at War\\CoDWaW.exe"=

R0 mv614x;mv614x;c:\windows\SYSTEM32\DRIVERS\mv614x.sys [2007-02-10 63232]
R0 xfilt;VIA SATA IDE Hot-plug Driver;c:\windows\SYSTEM32\DRIVERS\xfilt.sys [2007-02-10 11264]
R3 AtcL001;NDIS Miniport Driver for Attansic L1 Gigabit Ethernet Adapter;c:\windows\SYSTEM32\DRIVERS\atl01_xp.sys [2007-02-10 35712]
R3 V0330VID;WebCam Vista;c:\windows\SYSTEM32\DRIVERS\V0330Vid.sys [2007-09-04 178913]
S3 Asushwio;Asushwio;c:\windows\SYSTEM32\DRIVERS\ASUSHWIO.SYS [2007-02-10 5824]
S3 pwalker;Process Walker Driver;\??\c:\docume~1\Fedo\IMPOST~1\Temp\nsc3.tmp\pwalker.sys --> c:\docume~1\Fedo\IMPOST~1\Temp\nsc3.tmp\pwalker.sys [?]
S3 VX6000;Microsoft LifeCam VX-6000;c:\windows\SYSTEM32\DRIVERS\VX6000Xp.sys [2008-12-21 2077840]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ae42238a-9066-11dc-bc44-e7ba93ed0ee8}]
\Shell\AutoRun\command - F:\LaunchU3.exe -a

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{343798AF-F54F-CEC1-21D3-6344EBDA6E90}]
c:\windows\system32\wincool.exe s

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6BA60DC3-4777-3BBA-83C4-F1FA84FD6B0D}]
c:\windows\system32\yt777777777.exe

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{C5CD9787-54F4-6B5A-7054-5E50F28A8F48}]
c:\windows\crack\crack.exe s
.
Contenuto della cartella 'Scheduled Tasks'

2008-09-11 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\programmi\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]
.
.
------- Scansione supplementare -------
.
uStart Page = hxxp://www.google.it/webhp?rls=ig
IE: E&sporta in Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-03-22 12:37:45
Windows 5.1.2600 Service Pack 2 FAT NTAPI

scansione processi nascosti ...

scansione entrate autostart nascoste ...

Scansione files nascosti ...

Scansione completata con successo
Files nascosti: 0

**************************************************************************
.
--------------------- CHIAVI DI REGISTRO BLOCCATE ---------------------

[HKEY_USERS\S-1-5-21-1229272821-796845957-839522115-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:9f,6f,df,09,f1,8e,50,a8,90,72,b3,bb,2b,5f,9e,81,7c,82,65,09,d2,00,59,
b1,94,ba,e8,b2,d5,12,82,d3,c3,ab,6b,25,38,c2,27,48,d7,5e,9c,03,2d,88,c8,bd,\
"??"=hex:3b,9c,e0,ce,04,cf,d7,72,ba,05,6c,4e,96,61,c4,42

[HKEY_USERS\S-1-5-21-1229272821-796845957-839522115-1003\Software\SecuROM\License information*]
"datasecu"=hex:22,0b,ef,53,9b,eb,bc,b7,1b,c0,6c,05,61,da,aa,bc,aa,4d,3b,f6,23,
82,0a,c6,0f,58,5e,25,ae,fd,35,46,8f,29,f6,03,30,37,49,40,e7,a1,28,4a,97,e2,\
"rkeysecu"=hex:0d,06,69,8a,b9,24,ef,98,ee,a9,31,9f,b1,1b,ec,7a
.
--------------------- Dlls caricate dai processi in esecuzione ---------------------

- - - - - - - > 'winlogon.exe'(772)
c:\windows\system32\Ati2evxx.dll
.
Ora fine scansione: 2009-03-22 12.38.36
ComboFix-quarantined-files.txt 2009-03-22 11:38:36

Pre-Run: 52.458.684.416 byte disponibili
Post-Run: 53,995,995,136 byte disponibili

155

Resto in attesa, grazie mille
ciao

[zena]

Aggiungo che il problema che mi si ripresenta sempre è il tentativo di bloccare un file che si chiama mdmm.exe e nonostante provo a cancellarlo si rigenera sempre.
Ciao

[zena]

Help please....

[Luke57]

Ciao, vai qui:
http://www.suspectfile.com/forum/viewto ... 95&p=26391
scarica ed esegui il tool proposto, seguendo le istruzioni di Deifobe.

PS. Per avviare im modalità provvisoria, se non sai come fare:
http://www.upyou.it/smartfaq+faq.faqid+3.htm

Fammi sapere.

[zena]

ciao, intanto grazie dell'aiuto,
ho seguito tutto i punti. ti posto il log che mi è venuto fuori:


================================================================================
RICERCA
================================================================================

Attenzione! C:\WINDOWS\clipsrv.exe
Attenzione! C:\WINDOWS\esentutl.exe
Attenzione! C:\WINDOWS\system32\drivers\cmstp.exe
Attenzione! C:\Documents and Settings\Fedo\Dati applicazioni\rsvp.exe
Attenzione! C:\DOCUME~1\Fedo\IMPOST~1\Temp\mstinit.exe
Attenzione! C:\Documents and Settings\Fedo\Dati applicazioni\Microsoft\logman.exe
Attenzione! C:\Documents and Settings\Fedo\Dati applicazioni\Microsoft\mqtgsvc.exe


================================================================================
RICERCA
================================================================================

Attenzione! C:\WINDOWS\clipsrv.exe
Attenzione! C:\WINDOWS\esentutl.exe
Attenzione! C:\WINDOWS\system32\drivers\cmstp.exe
Attenzione! C:\Documents and Settings\Fedo\Dati applicazioni\rsvp.exe
Attenzione! C:\DOCUME~1\Fedo\IMPOST~1\Temp\mstinit.exe
Attenzione! C:\Documents and Settings\Fedo\Dati applicazioni\Microsoft\logman.exe
Attenzione! C:\Documents and Settings\Fedo\Dati applicazioni\Microsoft\mqtgsvc.exe


================================================================================
RIMOZIONE
================================================================================

File eliminati


================================================================================
RICERCA
================================================================================

Attenzione! C:\WINDOWS\clipsrv.exe


================================================================================
RIMOZIONE
================================================================================

File eliminati


================================================================================
RICERCA
================================================================================

Fine scansione. File non rilevati


spero di aver eliminato il problema. ti saprò dire.
grazie ancora